Skip to content
TrustedSkillsbeta
Back to all skills

Lucia Auth

Listed
ameistad·vlatest·security·MIT

Lucia-Auth verifies user identities against multiple sources, enhancing access control and reducing unauthorized system entry.

Repository

Install on your platform

Showing Claude Code. One command installs this skill into any of the agents below.

  1. 1

    Run this in your project

    terminal
    $ npx skills add ameistad/agent-skills --skill lucia-auth -a claude-code

  2. Uses the open-source skills CLI and needs Node.js. Add -g to install it for your user instead of this project.

What we know about this skill

Publisher

ameistad

Taken from the source listing. We haven't verified who controls this account.

Install target

Live repository

Not pinned. Installing fetches whatever the repository holds at the time you run the command.

No human has reviewed this code. The checks below are a static scan of the files at one commit — nobody has run this skill or judged whether it works. A skill runs with whatever access you give your agent, so read the source before you install it.

Automated safety checks

scanned

This skill failed 1 of 6 checks. A failure is not proof of bad intent; it means something in the code needs a human to look at it before you run it.

  • No undeclared network calls: failed

    Contacts 7 hosts that are neither well-known infrastructure nor declared in the skill's frontmatter: accounts.google.com, api.pwnedpasswords.com, bank.com, lucia-auth.com, oauth2.googleapis.com….

    Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.

    Hosts contacted

    github.comsource hostaccounts.google.comundeclaredoauth2.googleapis.comundeclaredapi.github.comsource hostopenidconnect.googleapis.comundeclaredapi.pwnedpasswords.comundeclaredbank.comundeclaredthecopenhagenbook.comundeclaredlucia-auth.comundeclared

    What it found (3 of 7)

    • lucia-auth/assets/oauth-handler.ts:46contacts accounts.google.com
      authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
    • lucia-auth/assets/oauth-handler.ts:47contacts oauth2.googleapis.com
      tokenEndpoint: "https://oauth2.googleapis.com/token",
    • lucia-auth/assets/oauth-handler.ts:335contacts openidconnect.googleapis.com
      "https://openidconnect.googleapis.com/v1/userinfo",

  • Declares what it does: passed

    SKILL.md parses and declares a name and a description.

    SKILL.md exists, its frontmatter parses, and it declares a name and a description.

  • No obfuscated payloads: passed

    No encoded or obfuscated payloads.

    No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.

  • No credential access: passed

    Reads no keys, tokens, keychains or credential files.

    Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.

  • No pipe-to-shell installers: passed

    No pipe-to-shell or download-and-run installers.

    No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.

  • Pinned to a commit: passed

    Scanned ameistad/agent-skills at 4c6b1dad1a.

    The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit
4c6b1dad1a
Manifest
lucia-auth/SKILL.md
Scanned
32 files, 4,600 lines
This is a static scan, not a review. It reads the skill's files; it does not run them, and it cannot tell you whether the skill is any good or whether the code does what its description says. A skill runs with whatever access you give your agent.
What each check looks for →

About this skill

What it does

The lucia-auth skill provides authentication capabilities to AI agents. It allows agents to verify user credentials against a database, manage sessions, and protect routes based on user roles or permissions. This enables secure access control for applications powered by AI agents.

When to use it

  • Building a member portal: Restrict access to certain features or content within an application only to authenticated users.
  • Creating a role-based system: Grant different levels of access and functionality based on user roles (e.g., administrator, editor, viewer).
  • Implementing secure API endpoints: Protect sensitive data and operations by requiring authentication before allowing access to specific API routes.
  • Developing multi-user applications: Manage user accounts, logins, and sessions for a platform with multiple users.

Key capabilities

  • User Authentication
  • Session Management
  • Role-Based Access Control (RBAC)
  • Database Integration

Example prompts

  • "Authenticate the user with username 'john.doe' and password 'password123'."
  • "Check if the current user has the 'administrator' role."
  • "Protect this route, requiring users to be logged in."

Tips & gotchas

  • Requires a database connection configured for user credential storage.
  • Properly configure your database schema and credentials before using the skill.